Account Security: Passwords, Passkeys, and Two-Factor Authentication
Your tradeSteward account controls live trading in your brokerage accounts, so it is worth a few minutes to lock it down properly.
All of the security tools below live in Account Settings. If you are setting up a new account, this order takes about five minutes end to end:
- Confirm your password is strong (you set it at signup).
- Add a passkey for one-tap, phishing-resistant sign-in.
- Turn on two-factor authentication as the fallback for password logins, and trust the devices you use daily.
- Pick a session timeout and an inactivity pause for your bots that match how often you check in.
Choose a strong password
Your password must be at least 10 characters and include an uppercase letter, a lowercase letter, a digit, and a special character. To change it, open Account Settings, find Change Account Password, enter your current password, then enter and confirm the new one.
If you ever get locked out, use the Forgot your password? link on the login page to reset it by email.
Add a passkey
Passkeys let you sign in with your device's built-in security, such as Touch ID, Face ID, or Windows Hello, instead of typing a password. They are phishing-resistant because each passkey only works with tradeSteward and never leaves your device's secure storage.
To create one, open Account Settings and select Create Your First Passkey (or Add New if you already have one). Your browser walks you through the confirmation on your device. From then on, the login page offers Sign in with Passkey.
You can rename or delete individual passkeys from the Manage Passkeys list, which also shows when each one was created and last used.
Turn on two-factor authentication
Two-factor authentication (2FA) adds a one-time code to your password sign-in. To enable it, select Enable 2FA in Account Settings, scan the QR code with an authenticator app such as Google Authenticator, Authy, or Microsoft Authenticator, and confirm with the 6-digit code the app shows.
At login you can check Trust this device and skip this next time and give the device a name. Trusted devices skip the code prompt; you can review and remove them any time from the Two-Factor Authentication Trusted Devices list.
Email changes and session limits
To change your login email, use Change Account Email Address in the User Information card. You confirm the change with your password and then verify the new address by email before it takes effect.
Under Account Access Settings you can also choose how quickly tradeSteward logs you out after inactivity, from 30 minutes up to 12 hours.
A separate protection, Pause Bots If No Activity For, watches how long it has been since you visited the website. If you are away longer than the window you choose, tradeSteward stops opening new automated trades, with the pause taking effect before the start of the trading day. It is an account protection feature: automation should never run for weeks without anyone watching it. tradeSteward emails you 12 hours before the pause would take effect and again once bots are paused, so a quick login is all it takes to keep things running while you travel.